Splunk Search: Night Events for all days

[angelo82]

Good Morning I'm looking for collect in Splunk Search all nights event logs between 08:00 PM and 07:00 AM

i've done this one:

'sourcetype="WinEventLog:Security" earliest=@d-4h latest=@d+7h`

and it's good only for last night

what should i do to collect this time range for all days?

i'm using Splunk 4.3.3

My Thanks in Advance

[Ayn · Accepted solution]

Extract the hour from the timestamp, then check events that match your conditions (very similar to what I answered in your other recent question). Something like this:

... | eval date_hour=strftime(_time, "%H") | search date_hour>=20 OR date_hour<7

[angelo82]

also this one works perfectly 🙂
thank you more

Regards
Angelo